CVE-2026-17084

Description

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.

References

https://mail.python.org/archives/list/[email protected]/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/

https://github.com/python/cpython/pull/155293

https://github.com/python/cpython/issues/155292

https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc

https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7

http://www.openwall.com/lists/oss-security/2026/08/18/2

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS